Bug #113 ยป 0001-fix-for-bug-113.patch
| src/detect-content.c | ||
|---|---|---|
|
return result;
|
||
|
}
|
||
|
/**
|
||
|
* \test Test cases where if within specified is < content lenggth we invalidate
|
||
|
* the sig.
|
||
|
*/
|
||
|
int DetectContentParseTest17(void)
|
||
|
{
|
||
|
int result = 0;
|
||
|
char *sigstr = "alert tcp any any -> any any (msg:\"Dummy\"; "
|
||
|
"content:one; content:two; within:2; sid:1;)";
|
||
|
DetectEngineCtx *de_ctx = DetectEngineCtxInit();
|
||
|
if (de_ctx == NULL)
|
||
|
goto end;
|
||
|
de_ctx->sig_list = SigInit(de_ctx, sigstr);
|
||
|
if (de_ctx->sig_list != NULL)
|
||
|
goto end;
|
||
|
result = 1;
|
||
|
end:
|
||
|
SigCleanSignatures(de_ctx);
|
||
|
if (de_ctx != NULL)
|
||
|
DetectEngineCtxFree(de_ctx);
|
||
|
return result;
|
||
|
}
|
||
|
static int SigTestPositiveTestContent(char *rule, uint8_t *buf)
|
||
|
{
|
||
|
uint16_t buflen = strlen((char *)buf);
|
||
| ... | ... | |
|
UtRegisterTest("DetectContentParseTest14", DetectContentParseNegTest14, 1);
|
||
|
UtRegisterTest("DetectContentParseTest15", DetectContentParseNegTest15, 1);
|
||
|
UtRegisterTest("DetectContentParseTest16", DetectContentParseNegTest16, 1);
|
||
|
UtRegisterTest("DetectContentParseTest17", DetectContentParseTest17, 1);
|
||
|
UtRegisterTest("DetectContentChunkTestB2G01 l=32", DetectContentChunkTestB2G01, 1);
|
||
|
UtRegisterTest("DetectContentChunkTestB3G01 l=32", DetectContentChunkTestB3G01, 1);
|
||
| src/detect-engine.c | ||
|---|---|---|
|
TmEcode DetectEngineThreadCtxDeinit(ThreadVars *tv, void *data) {
|
||
|
DetectEngineThreadCtx *det_ctx = (DetectEngineThreadCtx *)data;
|
||
|
if (det_ctx == NULL) {
|
||
|
SCLogWarning(SC_ERR_INVALID_ARGUMENTS, "argument \"data\" NULL");
|
||
|
return TM_ECODE_OK;
|
||
|
}
|
||
|
DetectEngineIPOnlyThreadDeinit(&det_ctx->io_ctx);
|
||
|
/** \todo get rid of this static */
|
||
| src/detect-within.c | ||
|---|---|---|
|
}
|
||
|
cd->within = strtol(str, NULL, 10);
|
||
|
if (cd->within < cd->content_len) {
|
||
|
SCLogError(SC_ERR_INVALID_SIGNATURE, "within argument \"%d\" is less "
|
||
|
"than the content length \"%s\" which is invalid, since this "
|
||
|
"will never match. Invalidating signature", cd->within, cd->content);
|
||
|
goto error;
|
||
|
}
|
||
|
cd->flags |= DETECT_CONTENT_WITHIN;
|
||
|
/** Propagate the modifiers through the first chunk
|
||
| src/detect.c | ||
|---|---|---|
|
}
|
||
|
static int SigTestContent05Real (int mpm_type) {
|
||
|
uint8_t *buf = (uint8_t *)"01234567890123456789012345678901abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
|
||
|
uint8_t *buf = (uint8_t *)"01234567890123456789012345678901PADabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ";
|
||
|
uint16_t buflen = strlen((char *)buf);
|
||
|
Packet p;
|
||
|
ThreadVars th_v;
|
||
|
DetectEngineThreadCtx *det_ctx;
|
||
|
DetectEngineThreadCtx *det_ctx = NULL;
|
||
|
int result = 0;
|
||
|
memset(&th_v, 0, sizeof(th_v));
|
||
| ... | ... | |
|
de_ctx->mpm_matcher = mpm_type;
|
||
|
de_ctx->flags |= DE_QUIET;
|
||
|
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; within:31; sid:1;)");
|
||
|
de_ctx->sig_list = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:0; within:32; sid:1;)");
|
||
|
if (de_ctx->sig_list == NULL) {
|
||
|
goto end;
|
||
|
}
|
||
|
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:1; within:33; sid:2;)");
|
||
|
de_ctx->sig_list->next = SigInit(de_ctx,"alert tcp any any -> any any (msg:\"Test 32\"; content:\"01234567890123456789012345678901\"; content:\"abcdefghijklmnopqrstuvwxyzABCDEF\"; distance:1; within:32; sid:2;)");
|
||
|
if (de_ctx->sig_list->next == NULL) {
|
||
|
goto end;
|
||
|
}
|
||